Oracle VM VirtualBox: Information disclosure and denial of service via local logon
Summary
Oracle VM VirtualBox Core component, affected version 7.2.16, contains a vulnerability (CWE-200, information exposure) that a low-privileged local user can exploit after logging on to the host. Successful exploitation can grant access to critical or all VirtualBox-accessible data, and can cause a hang or repeatable crash of VirtualBox; the scope change means impact may extend beyond VirtualBox itself. Oracle rates it CVSS 8.4 (High), and the vendor matrix states that remote exploitation without authentication is not possible.
Affected
- Oracle VM VirtualBox 7.2.16 (Core component), per Oracle's October 2026 Critical Patch Update matrix
- Versions prior to the fixed release are presumed affected; exact range not confirmed by vendor in the available sources
Fixed in
- Upgrade to VirtualBox 7.2.22 or the newest 7.2.x build. Tenable's plugin lists 7.2.18 as the fixed version, but this is unconfirmed; check Oracle's CSAF file before recording the fixed version in a change record.
- VirtualBox 7.1 is no longer under maintenance support since March 31, 2026 and will not receive this fix.
Workaround
- No vendor workaround known. The fix is a patch.
- Analyst recommendation: limit which accounts can log on to VirtualBox hosts.
- Analyst recommendation: restrict who can start and manage VMs.
- Analyst recommendation: do not run VirtualBox on shared hosts until patched.
Exploitation
- No reports of exploitation in the wild and no public proof of concept found.
- Oracle SSVC: exploitation none, not automatable, partial technical impact.
- EPSS score 0.00147 (low predicted exploitation probability).
- CISA KEV status not verified.
Our recommendation
- Update VirtualBox to 7.2.22 or the newest 7.2.x build, together with the other VirtualBox CVEs in the October 2026 CPU (including CVE-2026-87322 and CVE-2026-101598), in one maintenance window.
- Identify hosts running VirtualBox 7.1 or 7.2.16 and plan an upgrade.
- Prioritise shared developer workstations, lab servers and multi-user hosts; restrict local accounts and VM management rights in the meantime.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 www.oracle.com
- Ubuntu CVE-2026-87301 ubuntu.com
- Vulners NVD record CVE-2026-87301 vulners.com
- Tenable plugin VirtualBox CPU October 2026 vulners.com
- VirtualBox 7.2.22 release news (Linux Compatible) www.linuxcompatible.org
- VirtualBox news www.virtualbox.org
- Vulners OSV Ubuntu CVE-2026-87301 (EPSS) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:15.
Original description (NVD)
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.